Overview

overview

6

Static

static

3

2026-11-07...at.exe

windows10-2004-x64

6

2026-11-07...at.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 12:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe
  • Size 14.6MB
  • Sample261107-n7dkvsxv4k
  • SHA256 9b15c18122897673552600d6face60f332d3d18a9e3f89f75ad7da8102fb48dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe --webview-exe-version=2.8.3.0 --user-data-dir="C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --aggressive-cache-discard --application-name="CS Cheat Check" --disable-background-networking --disable-background-timer-throttling --disable-client-side-phishing-detection --disable-component-update --disable-default-apps --disable-domain-reliability --disable-extensions --disable-features=msSmartScreenProtection,msWebView2EnableTrackingPrevention,msWebView2EnableShoppingFeatures,msWebView2EnableFamilySafety,BackForwardCache,Prerender2,OverscrollHistoryNavigation,ElasticOverscroll,OptimizationHints,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions,PaintHolding,TranslateUI --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --disable-translate --disk-cache-size=1 --enable-features=MojoIpcz --js-flags="--max_old_space_size=128 --lite_mode --scavenger_max_new_space_capacity_mb=8" --media-cache-size=1 --no-first-run --no-service-autorun --renderer-process-limit=1 --v8-cache-options=none --mojo-named-platform-channel-pipe=4452.5836.13490335275551969985 /pfhostedapp:4873f9e2ddb81b2d09c2c956a204c8851665d84d
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView /prefetch:4 /pfhostedapp:4873f9e2ddb81b2d09c2c956a204c8851665d84d --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff853365fd8,0x7ff853365fe4,0x7ff853365ff0
        3⤵
          PID:4836
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView" --webview-exe-name=2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe --webview-exe-version=2.8.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1796,i,15629975919204866476,15057180074846021723,262144 --enable-features=MojoIpcz --disable-features=AutofillServerCommunication,BackForwardCache,ElasticOverscroll,InterestFeedContentSuggestions,MediaRouter,OptimizationHints,OverscrollHistoryNavigation,PaintHolding,Prerender2,TranslateUI,msSmartScreenProtection,msWebView2EnableFamilySafety,msWebView2EnableShoppingFeatures,msWebView2EnableTrackingPrevention --variations-seed-version /prefetch:2 /pfhostedapp:4873f9e2ddb81b2d09c2c956a204c8851665d84d
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2860
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView" --webview-exe-name=2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe --webview-exe-version=2.8.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1796,i,15629975919204866476,15057180074846021723,262144 --enable-features=MojoIpcz --disable-features=AutofillServerCommunication,BackForwardCache,ElasticOverscroll,InterestFeedContentSuggestions,MediaRouter,OptimizationHints,OverscrollHistoryNavigation,PaintHolding,Prerender2,TranslateUI,msSmartScreenProtection,msWebView2EnableFamilySafety,msWebView2EnableShoppingFeatures,msWebView2EnableTrackingPrevention --variations-seed-version /prefetch:3 /pfhostedapp:4873f9e2ddb81b2d09c2c956a204c8851665d84d
          3⤵
            PID:1924
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView" --webview-exe-name=2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe --webview-exe-version=2.8.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2364 --field-trial-handle=1796,i,15629975919204866476,15057180074846021723,262144 --enable-features=MojoIpcz --disable-features=AutofillServerCommunication,BackForwardCache,ElasticOverscroll,InterestFeedContentSuggestions,MediaRouter,OptimizationHints,OverscrollHistoryNavigation,PaintHolding,Prerender2,TranslateUI,msSmartScreenProtection,msWebView2EnableFamilySafety,msWebView2EnableShoppingFeatures,msWebView2EnableTrackingPrevention --variations-seed-version /prefetch:8 /pfhostedapp:4873f9e2ddb81b2d09c2c956a204c8851665d84d
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4536
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView" --webview-exe-name=2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe --webview-exe-version=2.8.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--max_old_space_size=128 --lite_mode --scavenger_max_new_space_capacity_mb=8 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3408 --field-trial-handle=1796,i,15629975919204866476,15057180074846021723,262144 --enable-features=MojoIpcz --disable-features=AutofillServerCommunication,BackForwardCache,ElasticOverscroll,InterestFeedContentSuggestions,MediaRouter,OptimizationHints,OverscrollHistoryNavigation,PaintHolding,Prerender2,TranslateUI,msSmartScreenProtection,msWebView2EnableFamilySafety,msWebView2EnableShoppingFeatures,msWebView2EnableTrackingPrevention --variations-seed-version /pfhostedapp:4873f9e2ddb81b2d09c2c956a204c8851665d84d /prefetch:1
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:2208
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView" --webview-exe-name=2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat.exe --webview-exe-version=2.8.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2092 --field-trial-handle=1796,i,15629975919204866476,15057180074846021723,262144 --enable-features=MojoIpcz --disable-features=AutofillServerCommunication,BackForwardCache,ElasticOverscroll,InterestFeedContentSuggestions,MediaRouter,OptimizationHints,OverscrollHistoryNavigation,PaintHolding,Prerender2,TranslateUI,msSmartScreenProtection,msWebView2EnableFamilySafety,msWebView2EnableShoppingFeatures,msWebView2EnableTrackingPrevention --variations-seed-version /prefetch:8 /pfhostedapp:4873f9e2ddb81b2d09c2c956a204c8851665d84d
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:236

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            3f590bbe-2d34-45a2-aa9a-ce406548010a.tmp
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\3f590bbe-2d34-45a2-aa9a-ce406548010a.tmp
            • Size 2KB
            • SHA256 f4c3286b5b50a80d54ce65ce634df114248cb0ec4bd778e5d5fad92a32812cde
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Crashpad\settings.dat
            • Size 280B
            • SHA256 25afe0c3377e42600833873b15d1c6e75db5b9d59f8ce03b8e4f4079015ec779
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Crashpad\settings.dat
            • Size 280B
            • SHA256 0bfacba087c0b94a9c0555c45af0f830fbfb45e5e7e619f9c92192f048a7496c
            • MD5 SHA1 SHA512
            Submit Download

            throttle_store.dat
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Crashpad\throttle_store.dat
            • Size 20B
            • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
            • MD5 SHA1 SHA512
            Submit Download

            37611e0f-4041-4c67-ac29-e8667ed404cc.tmp
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Default\37611e0f-4041-4c67-ac29-e8667ed404cc.tmp
            • Size 6KB
            • SHA256 08d6be3c1fb4ae69f8a6dfaf48da6ed7371793f0385cbb616b499e84c2e8e8de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            8e12efde-e2d9-41eb-b3dc-22dac307b610.tmp
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Default\Network\8e12efde-e2d9-41eb-b3dc-22dac307b610.tmp
            • Size 111B
            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Default\Network\Network Persistent State
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Default\Preferences
            • Size 5KB
            • SHA256 cf2dc3331168183d1a6f1a204e2c80b14b05bc0eaa1c8cf50be8e962b68278a3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            a8bba7a2-fa91-42b1-a1d6-594afe576cf5.tmp
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Default\a8bba7a2-fa91-42b1-a1d6-594afe576cf5.tmp
            • Size 5KB
            • SHA256 74b6b76428445133ee0f5a0ae9892a9c8cd544b59f5f90b726c6d0ba2f636cce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\GrShaderCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\GrShaderCache\data_1
            • Size 264KB
            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\GrShaderCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\GrShaderCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\Local State
            • Size 1KB
            • SHA256 79f5556774d26547b2aed1b67c1a053f42aa62d8b799c4f6eaf177c00e6a802d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            a29077d3-a0d3-4410-bd4e-e03827eaff20.tmp
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\a29077d3-a0d3-4410-bd4e-e03827eaff20.tmp
            • Size 3KB
            • SHA256 e74a22973a91058bcd19e6413f1fb89de6116e3e816e0aa441a7332fb48ab56e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            bffadb41-3188-4fdf-9e9c-140e1f710a84.tmp
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\bffadb41-3188-4fdf-9e9c-140e1f710a84.tmp
            • Size 3KB
            • SHA256 7a3d0d481badcbeb9cbeff6d96e198731da135121f4c8d4b5d49e83121e1f3d7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ded69d83-054a-4e62-9633-24240c5cabf2.tmp
            • Path C:\Users\Admin\AppData\Local\CsCheatCheck\WebView2\EBWebView\ded69d83-054a-4e62-9633-24240c5cabf2.tmp
            • Size 3KB
            • SHA256 f4652008d068914d6b462177de91d3eef0055cb50139c9fcb9a74de96c9c365f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/236-260-0x000001A793A90000-0x000001A793A91000-memory.dmp
            Download

            memory/236-251-0x000001A793A90000-0x000001A793A91000-memory.dmp
            Download

            memory/236-253-0x000001A793A90000-0x000001A793A91000-memory.dmp
            Download

            memory/236-258-0x000001A793A90000-0x000001A793A91000-memory.dmp
            Download

            memory/236-261-0x000001A793A90000-0x000001A793A91000-memory.dmp
            Download

            memory/236-259-0x000001A793A90000-0x000001A793A91000-memory.dmp
            Download

            memory/236-262-0x000001A793A90000-0x000001A793A91000-memory.dmp
            Download

            memory/236-257-0x000001A793A90000-0x000001A793A91000-memory.dmp
            Download

            memory/2208-89-0x00007FF874600000-0x00007FF874601000-memory.dmp
            Download

            memory/2860-28-0x00007FF874600000-0x00007FF874601000-memory.dmp
            Download